canopycms 0.0.0

package/src/__integration__/test-utils/test-workspace.ts

@@ -0,0 +1,130 @@
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { simpleGit } from 'simple-git'
+import { vi } from 'vitest'
+import type { CanopyConfig } from '../../config'
+import { defineCanopyTestConfig } from '../../config-test'
+import { initTestRepo } from '../../test-utils'
+
+/**
+ * Initialize a bare git repository with the specified default branch.
+ * This ensures the bare repo's HEAD points to the correct branch when cloning.
+ *
+ * @param remotePath - Path where the bare repository should be created
+ * @param defaultBranch - The default branch name (defaults to 'main')
+ * @returns A simpleGit instance configured for the bare repository
+ */
+export async function initBareRepo(remotePath: string, defaultBranch = 'main') {
+  await simpleGit().raw(['init', '--bare', `--initial-branch=${defaultBranch}`, remotePath])
+  return simpleGit({ baseDir: remotePath })
+}
+
+export interface TestWorkspace {
+  /** Root temporary directory for this workspace */
+  tmpRoot: string
+  /** Path to bare git remote */
+  remotePath: string
+  /** Path to seed clone (initial commit) */
+  seedPath: string
+  /** Full Canopy configuration */
+  config: CanopyConfig
+  /** Cleanup function to remove all temp files and restore cwd mock */
+  cleanup: () => Promise<void>
+}
+
+/**
+ * Creates an isolated test environment with temp directory and bare git remote.
+ *
+ * Directory structure created:
+ * ```
+ * tmpRoot/
+ *   ├── remote.git/       (bare git remote)
+ *   ├── seed/             (initial clone with content/)
+ *   └── branches/         (workspace clones will be created here)
+ * ```
+ *
+ * Based on the pattern from branch-workflow.integration.test.ts
+ */
+// Warnings to suppress in integration tests (expected when using local git repos)
+const suppressedWarnings: (string | RegExp)[] = [
+  'CanopyCMS: GitHub token not found',
+  'CanopyCMS: Failed to parse GitHub remote URL',
+  'CanopyCMS: GitHub service requires remoteUrl',
+]
+
+export async function createTestWorkspace(
+  configOverrides?: Partial<Parameters<typeof defineCanopyTestConfig>[0]>,
+): Promise<TestWorkspace> {
+  // Suppress known CanopyCMS warnings that are expected in integration tests
+  const originalWarn = console.warn
+  const warnSpy = vi.spyOn(console, 'warn').mockImplementation((...args) => {
+    const message = String(args[0] ?? '')
+    const shouldSuppress = suppressedWarnings.some((pattern) =>
+      typeof pattern === 'string' ? message.includes(pattern) : pattern.test(message),
+    )
+    if (!shouldSuppress) {
+      originalWarn.apply(console, args)
+    }
+  })
+
+  // Create root temp directory
+  const tmpRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'canopy-test-'))
+  const remotePath = path.join(tmpRoot, 'remote.git')
+  const seedPath = path.join(tmpRoot, 'seed')
+
+  try {
+    // Initialize bare remote
+    await initBareRepo(remotePath)
+
+    // Create and configure seed clone
+    await fs.mkdir(seedPath, { recursive: true })
+    const seedGit = await initTestRepo(seedPath)
+    await seedGit.raw(['branch', '-M', 'main'])
+
+    // Create initial content directory
+    await fs.mkdir(path.join(seedPath, 'content'), { recursive: true })
+
+    // Create initial commit with README
+    await fs.writeFile(path.join(seedPath, 'README.md'), '# Test Repository\n', 'utf8')
+    await seedGit.add(['.'])
+    await seedGit.commit('Initial commit')
+
+    // Push to remote
+    await seedGit.addRemote('origin', remotePath)
+    await seedGit.push('origin', 'main', { '--set-upstream': null })
+
+    // Create config
+    const config = defineCanopyTestConfig({
+      mode: 'prod-sim',
+      defaultBranchAccess: 'allow',
+      defaultPathAccess: 'allow',
+      defaultBaseBranch: 'main',
+      defaultRemoteName: 'origin',
+      defaultRemoteUrl: remotePath,
+      schema: { collections: [] },
+      ...configOverrides,
+    })
+
+    // Mock process.cwd() to return tmpRoot so BranchRegistry uses isolated path
+    // This prevents parallel tests from corrupting shared registry files
+    const cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(tmpRoot)
+
+    return {
+      tmpRoot,
+      remotePath,
+      seedPath,
+      config,
+      cleanup: async () => {
+        warnSpy.mockRestore()
+        cwdSpy.mockRestore()
+        await fs.rm(tmpRoot, { recursive: true, force: true })
+      },
+    }
+  } catch (error) {
+    // Cleanup on error
+    warnSpy.mockRestore()
+    await fs.rm(tmpRoot, { recursive: true, force: true }).catch(() => {})
+    throw error
+  }
+}

package/src/__integration__/user/user-context.test.ts

@@ -0,0 +1,174 @@
+/**
+ * Integration tests for user context API endpoint.
+ * Tests the /whoami endpoint that returns current user info.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+
+import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
+import { createMockAuthPlugin } from '../test-utils/multi-user'
+import { createApiClient } from '../test-utils/api-client'
+import { BLOG_SCHEMA } from '../fixtures/schemas'
+import type { UserInfoResponse } from '../../api/user'
+import type { AuthPlugin } from '../../auth/plugin'
+import type { AuthenticationResult } from '../../auth/types'
+
+/**
+ * Helper to create a mock auth plugin with custom userId and groups
+ */
+function createCustomAuthPlugin(userId: string, groups: string[]): AuthPlugin {
+  return {
+    async authenticate(_context: unknown): Promise<AuthenticationResult> {
+      return {
+        success: true,
+        user: {
+          userId: `test-${userId}`,
+          email: `${userId}@test.local`,
+          name: `Test ${userId}`,
+          externalGroups: groups,
+        },
+      }
+    },
+    async searchUsers() {
+      return []
+    },
+    async getUserMetadata() {
+      return null
+    },
+    async getGroupMetadata() {
+      return null
+    },
+    async listGroups() {
+      return []
+    },
+    async searchExternalGroups() {
+      return []
+    },
+  }
+}
+
+describe('User Context API Integration', () => {
+  let workspace: TestWorkspace
+  let adminClient: Awaited<ReturnType<typeof createApiClient>>
+  let editorClient: Awaited<ReturnType<typeof createApiClient>>
+  let reviewerClient: Awaited<ReturnType<typeof createApiClient>>
+
+  beforeEach(async () => {
+    workspace = await createTestWorkspace({
+      schema: BLOG_SCHEMA,
+    })
+
+    // Create API clients for different users with different group memberships
+    adminClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('admin'),
+      schema: BLOG_SCHEMA,
+    })
+
+    editorClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('editor'),
+      schema: BLOG_SCHEMA,
+    })
+
+    reviewerClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('reviewer'),
+      schema: BLOG_SCHEMA,
+    })
+  })
+
+  afterEach(async () => {
+    await workspace.cleanup()
+  })
+
+  it('returns correct user info for admin user', async () => {
+    const response = await adminClient.get('/api/canopycms/whoami')
+
+    expect(response.status).toBe(200)
+    expect(response.ok).toBe(true)
+
+    const data = await response.json<UserInfoResponse>()
+    expect(data.ok).toBe(true)
+    expect(data.data?.userId).toBe('test-admin')
+    expect(data.data?.groups).toContain('Admins')
+  })
+
+  it('returns correct user info for editor user', async () => {
+    const response = await editorClient.get('/api/canopycms/whoami')
+
+    expect(response.status).toBe(200)
+    expect(response.ok).toBe(true)
+
+    const data = await response.json<UserInfoResponse>()
+    expect(data.ok).toBe(true)
+    expect(data.data?.userId).toBe('test-editor')
+    expect(data.data?.groups).toContain('ContentEditors')
+  })
+
+  it('returns correct user info for reviewer user', async () => {
+    const response = await reviewerClient.get('/api/canopycms/whoami')
+
+    expect(response.status).toBe(200)
+    expect(response.ok).toBe(true)
+
+    const data = await response.json<UserInfoResponse>()
+    expect(data.ok).toBe(true)
+    expect(data.data?.userId).toBe('test-reviewer')
+    expect(data.data?.groups).toContain('Reviewers')
+  })
+
+  it('returns all groups when user belongs to multiple', async () => {
+    // Create a client for a user with multiple groups
+    const multiGroupClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createCustomAuthPlugin('multi-group-user', ['ContentEditors', 'Reviewers']),
+      schema: BLOG_SCHEMA,
+    })
+
+    const response = await multiGroupClient.get('/api/canopycms/whoami')
+
+    expect(response.status).toBe(200)
+    const data = await response.json<UserInfoResponse>()
+    expect(data.ok).toBe(true)
+    expect(data.data?.userId).toBe('test-multi-group-user')
+    expect(data.data?.groups).toContain('ContentEditors')
+    expect(data.data?.groups).toContain('Reviewers')
+    expect(data.data?.groups).toHaveLength(2)
+  })
+
+  it('endpoint is accessible without special permissions', async () => {
+    // All authenticated users should be able to call /whoami
+    const responses = await Promise.all([
+      adminClient.get('/api/canopycms/whoami'),
+      editorClient.get('/api/canopycms/whoami'),
+      reviewerClient.get('/api/canopycms/whoami'),
+    ])
+
+    // All should succeed
+    responses.forEach((response) => {
+      expect(response.status).toBe(200)
+      expect(response.ok).toBe(true)
+    })
+  })
+
+  it('integrates with BranchManager permissions via user context', async () => {
+    // Create a branch as editor
+    const createResponse = await editorClient.post('/api/canopycms/branches', {
+      branch: 'feature/editor-branch',
+      title: 'Test Branch',
+    })
+    expect(createResponse.status).toBe(200)
+
+    // Verify the branch was created by the correct user
+    const branchData = await createResponse.json<any>()
+    expect(branchData.data?.branch.createdBy).toBe('test-editor')
+
+    // Get user info to confirm it matches
+    const whoamiResponse = await editorClient.get('/api/canopycms/whoami')
+    const whoamiData = await whoamiResponse.json<UserInfoResponse>()
+
+    expect(whoamiData.data?.userId).toBe('test-editor')
+    expect(branchData.data?.branch.createdBy).toBe(whoamiData.data?.userId)
+  })
+})

package/src/__integration__/validation/input-validation.test.ts

@@ -0,0 +1,166 @@
+/**
+ * Integration tests for HTTP-level input validation.
+ * Tests Zod schema validation that happens in the handler layer.
+ * Tests go through the HTTP API layer.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+
+import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
+import { createMockAuthPlugin } from '../test-utils/multi-user'
+import { createApiClient } from '../test-utils/api-client'
+import { BLOG_SCHEMA } from '../fixtures/schemas'
+import type { ApiResponse } from '../../api/types'
+
+describe('Input Validation', () => {
+  let workspace: TestWorkspace
+  let editorClient: Awaited<ReturnType<typeof createApiClient>>
+
+  beforeEach(async () => {
+    workspace = await createTestWorkspace({
+      schema: BLOG_SCHEMA,
+    })
+
+    editorClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('editor'),
+      schema: BLOG_SCHEMA,
+    })
+  })
+
+  afterEach(async () => {
+    await workspace.cleanup()
+  })
+
+  describe('Branch Creation', () => {
+    it('rejects missing branch name', async () => {
+      // Try to create branch with empty branch name
+      const response = await editorClient.post('/api/canopycms/branches', {
+        branch: '',
+        title: 'Test Branch',
+      })
+
+      expect(response.status).toBe(400)
+      expect(response.ok).toBe(false)
+      const error = await response.json<ApiResponse>()
+      expect(error.error).toBeDefined()
+      expect(error.error).toContain('branch')
+    })
+  })
+
+  describe('Branch Deletion', () => {
+    it('returns 404 if branch param missing', async () => {
+      // Try to delete with empty branch parameter
+      // Note: Router returns 404 when path params are missing (not matched route)
+      const response = await editorClient.delete('/api/canopycms/')
+
+      expect(response.status).toBe(404)
+      expect(response.ok).toBe(false)
+      const error = await response.json<ApiResponse>()
+      expect(error.error).toBeDefined()
+    })
+  })
+
+  describe('Branch Access Update', () => {
+    it('returns 404 if branch param missing', async () => {
+      // First create a branch
+      await editorClient.post('/api/canopycms/branches', {
+        branch: 'test-branch',
+        title: 'Test Branch',
+      })
+
+      // Try to update access with empty branch parameter
+      // Note: Router returns 404 when path params are missing (not matched route)
+      const response = await editorClient.patch('/api/canopycms//access', {
+        allowedUsers: ['user1'],
+      })
+
+      expect(response.status).toBe(404)
+      expect(response.ok).toBe(false)
+      const error = await response.json<ApiResponse>()
+      expect(error.error).toBeDefined()
+    })
+  })
+
+  describe('Comment Creation', () => {
+    beforeEach(async () => {
+      // Create a test branch for comment tests
+      await editorClient.post('/api/canopycms/branches', {
+        branch: 'feature/comments',
+        title: 'Comments Test',
+      })
+    })
+
+    it('returns 400 if text is missing', async () => {
+      // Try to add comment without text field
+      const response = await editorClient.post('/api/canopycms/feature-comments/comments', {
+        type: 'field',
+        entryPath: 'posts/test',
+        canopyPath: 'title',
+        // Missing: text
+      } as any)
+
+      expect(response.status).toBe(400)
+      expect(response.ok).toBe(false)
+      const error = await response.json<ApiResponse>()
+      expect(error.error).toBeDefined()
+      expect(error.error).toContain('text')
+    })
+
+    it('returns 400 if type is missing', async () => {
+      // Try to add comment without type field
+      const response = await editorClient.post('/api/canopycms/feature-comments/comments', {
+        text: 'This is a test comment',
+        entryPath: 'posts/test',
+        canopyPath: 'title',
+        // Missing: type
+      } as any)
+
+      expect(response.status).toBe(400)
+      expect(response.ok).toBe(false)
+      const error = await response.json<ApiResponse>()
+      expect(error.error).toBeDefined()
+      expect(error.error).toContain('type')
+    })
+  })
+
+  describe('Additional Validation', () => {
+    it('validates comment type enum values', async () => {
+      // Create test branch
+      await editorClient.post('/api/canopycms/branches', {
+        branch: 'feature/enum-test',
+        title: 'Enum Test',
+      })
+
+      // Try to add comment with invalid type
+      const response = await editorClient.post('/api/canopycms/feature-enum-test/comments', {
+        text: 'Test comment',
+        type: 'invalid-type',
+        entryPath: 'posts/test',
+      } as any)
+
+      expect(response.status).toBe(400)
+      expect(response.ok).toBe(false)
+      const error = await response.json<ApiResponse>()
+      expect(error.error).toBeDefined()
+    })
+
+    it('validates required threadId parameter for resolve', async () => {
+      // Create test branch
+      await editorClient.post('/api/canopycms/branches', {
+        branch: 'feature/resolve-test',
+        title: 'Resolve Test',
+      })
+
+      // Try to resolve with empty threadId
+      // Note: Router returns 404 when path params are missing (not matched route)
+      const response = await editorClient.post(
+        '/api/canopycms/feature-resolve-test/comments//resolve',
+        {},
+      )
+
+      expect(response.status).toBe(404)
+      expect(response.ok).toBe(false)
+    })
+  })
+})